Underflow Vulnerability in libtiff's tiffcrop Tool
Summary
CVE-2022-2869: libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. Affects tiff across 2 version ranges.
< 4.4.0-r0
< b6a17e567f143fab49734a9e09e5bafeb6f97354
Fixed in 4.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is an open-source library for reading and writing TIFF image files. It provides various tools, including tiffcrop, which is used for cropping TIFF images. The library is widely used in applications that handle image processing and manipulation. However, a vulnerability has been discovered in the tiffcrop tool, which can be exploited by an attacker to cause a crash or potentially execute further attacks.
Vulnerability Detail
The vulnerability (CVE-2022-2869) in libtiff's tiffcrop tool is due to a uint32_t underflow in the extractContigSamples8bits routine. This underflow leads to an out-of-bounds read and write, which can be triggered by supplying a crafted file to tiffcrop. An attacker can exploit this flaw by tricking a user into opening the malicious file with tiffcrop. The consequences of triggering this vulnerability can range from a crash to potential further exploitation of the system.
How To Fix
Minimum fixed version
4.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the libtiff package to the fixed version as soon as possible.
Conclusion
The underflow vulnerability in libtiff's tiffcrop tool (CVE-2022-2869) poses a risk to systems that use the affected version of the library. It is crucial to update the libtiff package to version 4.4.0-r0 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
libtiff is an open-source library for reading and writing TIFF image files. It is commonly used in applications that deal with image processing and manipulation.
tiffcrop is a tool provided by libtiff for cropping TIFF images. It is susceptible to the underflow vulnerability described in CVE-2022-2869.
An attacker can exploit this vulnerability by supplying a crafted file to the tiffcrop tool and tricking a user into opening it. This can lead to a crash or further exploitation of the system.
The impact of this vulnerability can range from a crash to potential further exploitation of the system. It is crucial to update the libtiff package to mitigate the risk.
No, there is no known workaround for this vulnerability. Updating the libtiff package to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
